nginx.conf

server {
    listen       3000;
    listen  [::]:3000;
    server_name  _;
    server_tokens off;

    root   /usr/share/nginx/html;
    index  index.html;

    # Server-level include covers responses that don't match any location
    # with its own add_header (e.g. default 50x).
    include /etc/nginx/security-headers.inc;

    # ---------- Gzip ----------
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types
        text/plain text/css text/xml text/javascript
        application/javascript application/x-javascript application/json
        application/xml application/xml+rss application/wasm
        image/svg+xml;

    # ---------- Health endpoint ----------
    location = /healthz {
        access_log off;
        add_header Content-Type text/plain;
        return 200 "ok";
    }

    # ---------- Hashed asset cache ----------
    location /assets/ {
        include /etc/nginx/security-headers.inc;
        access_log off;
        expires 1y;
        add_header Cache-Control "public, max-age=31536000, immutable" always;
        try_files $uri =404;
    }

    location ~* \.(?:ico|svg|png|jpg|jpeg|gif|webp|woff2?|ttf|otf|eot)$ {
        include /etc/nginx/security-headers.inc;
        access_log off;
        expires 7d;
        add_header Cache-Control "public, max-age=604800" always;
        try_files $uri =404;
    }

    # ---------- Never cache entry HTML ----------
    location = /index.html {
        include /etc/nginx/security-headers.inc;
        add_header Cache-Control "no-store, no-cache, must-revalidate" always;
        expires 0;
    }

    location = /robots.txt {
        include /etc/nginx/security-headers.inc;
        access_log off;
        add_header Cache-Control "public, max-age=3600" always;
    }

    location = /version.json {
        include /etc/nginx/security-headers.inc;
        access_log off;
        add_header Cache-Control "no-store" always;
    }

    # ---------- SPA fallback ----------
    location / {
        try_files $uri $uri/ /index.html;
    }

    error_page 500 502 503 504 /50x.html;
    location = /50x.html { internal; }
}